Weaknesses of type CWE-74

4,758 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-3171MEDIUMProject Worlds Online Lawyer Management System approve_lawyer.php sql injectionEPSS 0.5%CVE-2026-1129MEDIUMYonyou KSOA HTTP GET Parameter worksadd.jsp sql injectionEPSS 0.5%CVE-2025-4875MEDIUMCampcodes Online Shopping Portal forgot-password.php sql injectionEPSS 0.5%CVE-2025-1962MEDIUMprojectworlds Online Hotel Booking addroom.php sql injectionEPSS 0.5%CVE-2025-4895MEDIUMSourceCodester Doctors Appointment System delete-session.php sql injectionEPSS 0.5%CVE-2025-4881MEDIUMitsourcecode Restaurant Management System user_save.php sql injectionEPSS 0.5%CVE-2025-4882MEDIUMitsourcecode Restaurant Management System team_update.php sql injectionEPSS 0.5%CVE-2025-4900MEDIUMCampcodes Sales and Inventory System payment.php sql injectionEPSS 0.5%CVE-2025-4837MEDIUMprojectworlds Student Project Allocation System make_group_sql.php sql injectionEPSS 0.5%CVE-2025-4899MEDIUMCampcodes Sales and Inventory System transaction_update.php sql injectionEPSS 0.5%CVE-2024-12007MEDIUMcode-projects Farmacia visualizar-produto.php sql injectionEPSS 0.5%CVE-2024-12360MEDIUMcode-projects Online Class and Exam Scheduling System class_update.php sql injectionEPSS 0.5%CVE-2026-1130MEDIUMYonyou KSOA HTTP GET Parameter worksadd_plan.jsp sql injectionEPSS 0.5%CVE-2025-1952MEDIUMPHPGurukul Restaurant Table Booking System password-recovery.php sql injectionEPSS 0.5%CVE-2025-1857MEDIUMPHPGurukul Nipah Virus Testing Management System check_availability.php sql injectionEPSS 0.5%CVE-2025-0563MEDIUMcode-projects Fantasy-Cricket update.php sql injectionEPSS 0.5%CVE-2025-0872MEDIUMitsourcecode Tailoring Management System addpayment.php sql injectionEPSS 0.5%CVE-2025-1832MEDIUMzj1983 zz ZroleAction.java getUserList sql injectionEPSS 0.5%CVE-2025-0873MEDIUMitsourcecode Tailoring Management System customeredit.php sql injectionEPSS 0.5%CVE-2025-1380MEDIUMCodezips Gym Management System del_plan.php sql injectionEPSS 0.5%